SqlSecureConnection: Enforced Encryption could use CimInstance

The new resource https://github.com/PowerShell/SqlServerDsc#sqlserversecureconnection introduce ForceEncryption and Thumbprint, although it is using the registry to set this, so that resource could be changed to use the CimInstance instead.

Enforced Encryption is a property in the DB instances network properties and found via SQL Server Configuration Manager, see sample code:

##  apply surface area configuration control 2.12
$WmiObject = @{
    ComputerName = $SQLServer.NetName
    Namespace    = "root\Microsoft\SqlServer\ComputerManagement$($SQLServer.VersionMajor)"
    Class        = "ServerSettingsGeneralFlag"
    Filter       = "FlagName = 'HideInstance'"
}
$HideInstance = Get-WmiObject @WmiObject

if ($HideInstance.FlagValue -eq $false) {
    Write-Verbose "Setting HideInstance to True."
    $HideInstance.SetValue($true) | Out-Null
    Write-Verbose "HideInstance set to True"
}

##  apply surface area configuration control 8.2
$WmiObject = @{
    ComputerName = $SQLServer.NetName
    Namespace    = "root\Microsoft\SqlServer\ComputerManagement$($SQLServer.VersionMajor)"
    Class        = "ServerSettingsGeneralFlag"
    Filter       = "FlagName = 'ForceEncryption'"
}
$ForceEncryption = Get-WmiObject @WmiObject

if ($ForceEncryption.FlagValue -eq $false) {
    Write-Verbose "Setting ForceEncryption to True."
    $ForceEncryption.SetValue($true) | Out-Null
    Write-Verbose "ForceEncryption set to True"
}

Note $SQLServer is the SMO object

However this would only be half a solution as some client may wish to apply the certificate with this option.

Originally posted by @SQLHorizons in https://github.com/dsccommunity/SqlServerDsc/issues/1161#issuecomment-423769834

Begin with the SqlServerSecureConnection resource and review how ForceEncryption and Thumbprint currently use the registry. Compare that behavior with the provided ServerSettingsGeneralFlag WMI example. Clarify whether certificate application is in scope, then define completion as consistent CIM-based encryption configuration and an agreed certificate path.